NVD published CVE-2026-76418 on October 28, 2026. CISA added it to the KEV catalog the next day, October 29, with a deadline of November 1.
This isn't code execution — it's denial of service. An unauthenticated attacker sends a crafted request to the remote access SSL VPN on a Cisco Secure Firewall ASA or FTD, and the device reloads. On a perimeter firewall, that takes down remote workers' VPN and everything else flowing through the box.
Cisco has had a busy autumn in the KEV catalog: CVE-2026-76504 in Catalyst SD-WAN Manager at the end of September, CVE-2026-76519 in Secure Email Gateway in mid-October, and now the VPN on its firewalls.
The Vulnerability
| Field | Value |
|---|---|
| CVE | CVE-2026-76418 |
| CVSS 3.1 (Cisco, CNA) | 8.6 (HIGH) — AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| Type | Unchecked return value to NULL pointer dereference (CWE-690) |
| Component | Remote Access SSL VPN service |
| Products | Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense (FTD) Software |
| NVD published | 2026-10-28 |
| NVD status | Undergoing Analysis |
| Added to CISA KEV | 2026-10-29 |
| CISA deadline | 2026-11-01 |
NVD description (excerpt):
This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN.
The Condition That Matters: Secondary Authentication
Not every SSL VPN is exposed. The bug triggers when a tunnel group (connection profile) is configured with secondary authentication — a second authentication source on top of the first, say a directory followed by a RADIUS server.
That's a common setup in organisations that have hardened their remote access. The irony: those are exactly the ones exposed here.
To check, look for secondary-authentication-server-group in the configuration:
show running-config tunnel-group | include tunnel-group|secondary-authentication
On FTD managed by FMC, the same option sits in the remote access VPN policy, on the connection profile.
Why 8.6 and Not Higher
The vector is pure denial of service: C:N/I:N/A:H, no data leaked or altered. The S:C (changed scope) reflects that a firewall reload hits far more than the VPN service — all traffic through the device stops.
Why a DoS Lands in KEV
Denial-of-service bugs often sink to the bottom of the queue. But a firewall that reboots on demand means:
- VPN down for every remote user, for as long as the attacker keeps sending the request;
- a perimeter outage if the device isn't in a high-availability pair;
- more broadly, a way to create disruption while something else happens elsewhere, or to force repeated HA failovers.
Neither NVD nor CISA describe the observed attacks. A KEV listing only means exploitation has been seen.
Affected Versions
NVD has no CPE configuration yet for this CVE (status Undergoing Analysis), so there are no version bounds on the NVD side. The list of vulnerable and fixed releases is in Cisco's advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
Cisco's Software Checker also tells you, for a given ASA or FTD release, which advisories apply and the first fixed release.
Check your version:
show version
Detection
- Unexpected reloads of ASA or FTD firewalls since late October:
show versiongives uptime and the last reload reason - Crash files (
show crashinfo) written around those reloads - High-availability failovers with no identified cause
- Abnormal or repeated SSL VPN connection attempts from the same addresses just before a reload
Mitigation
1. Upgrade to the fixed release Cisco lists
The CISA deadline is November 1. The Software Checker gives the target release for your train.
2. In the meantime
- Check whether secondary authentication is actually configured: if no tunnel group uses it, the condition NVD describes isn't met (confirm in Cisco's advisory)
- Don't rip out secondary authentication without weighing it: dropping an authentication factor from your VPN to dodge a DoS is a bad trade. Cisco's advisory says whether an official workaround exists
- Make sure high availability is in place and working, to limit the impact of a reload
3. After upgrading
Keep an eye on device uptime over the following days to confirm the reloads have stopped.
Why Continuous Monitoring of Your Firewalls Matters
One day from publication to KEV, three days to the deadline: across a firewall estate, keeping that pace means knowing instantly which ASA or FTD release runs on each device.
With cveo.tech, inventory your Cisco firewalls with exact versions and get alerted as soon as a CVE affecting them is published or added to CISA KEV.